San Diego City Council Audit Committee Meeting - May 16, 2018

The San Diego City Council Audit Committee convened on May 16, 2018, with a quorum present (Councilmember Scott Sherman, Ricardo Valdivia, and Tom Hebrink; Alan Spencer absent). The committee heard the City Auditor's monthly activity report, the Q3 FY2018 fraud hotline update, the federal compliance single audit results, the annual internal financial controls report, and began the consultation process for appointing the next City Auditor. All votes were unanimous, and the next meeting was scheduled for June 27, 2018.

Consent Calendar

• The record of action from the April 28, 2018 meeting was approved by unanimous consent with no discussion.
• No public non-agenda comments were received.

City Auditor Monthly Activity Report (Item 4)

Eduardo Luna, City Auditor, presented the April 2018 activity report:

• Six audit reports are in the report-writing stage, projected to be issued in May and June: Transportation & Stormwater Division, Development Impact Fees, City's Fiscal Sustainability and Financial Condition, IT audit of data security controls for sensitive police data, Capital, and Real Estate Assets/Surplus Properties.
• Three reports scheduled for completion by July are in fieldwork: Community Planning Groups, Vehicle Acquisition under Fleet Services, and IT audit of Excel implementation.
• Two audits are in the planning stage: Mission Bay Fund FY2017 and an IT audit of the security of the City Hub and supporting infrastructure.
• Two audits have not started: IT audit of disaster recovery preparedness and the annual Central Stores inventory audit.
• The water billing audit is targeted for end of June 2018. The Community Planning Groups audit is a comprehensive review of the planning group process and decisions, with several recommendations expected to improve the process.

Fraud Hotline Q3 FY2018 Report (Item 5)

Andy Harida, Fraud Investigator, Office of the City Auditor, presented the third-quarter report:

• 47 fraud hotline complaints were received in Q3: 8 assigned to the Office of the City Auditor, 24 assigned to departments, and 15 not in the purview of the hotline or not involving city operations.
• There were 46 city-related complaints open on January 1, 2018; 32 were added, for 78 active complaints; 36 were closed during the quarter, leaving 42 open at quarter-end.
• Two city auditor investigations were substantiated: (1) private youth sports businesses conducting referee activities without background checks—one recommendation issued, management agreed to implement it, and a public report was posted; (2) attempted theft of city-provided clothing—one recommendation issued, management agreed to implement it, and a public report was posted.
• Four department investigations were substantiated, including theft of time and an employee using a handheld cell phone while driving a city vehicle; departments took appropriate corrective action.
• One city auditor investigation and nine department investigations led to corrective actions, including email search issues, abuse of discretion, undeliverable mail sent by a department, vehicle use, supervisor misconduct, vendors parking illegally, theft of time by a supervisor, workplace safety, and improved security for utility bill payment processing.
• In response to questions: department-referred cases have a 30-day target response time, while complex auditor investigations average about five months. Harida noted he receives assistance from performance auditors but stated an argument could be made for more resources. One older fraud case from March of the prior year is active and expected to close this quarter; the lack-of-safety-training complaint was specific to one employee under unusual circumstances.

Federal Compliance Single Audit Results (Discussion Item 1)

Kevin Starkey (Partner, MGO) and Jeff Peel presented the federal compliance portion of the annual single audit for the fiscal year ending June 30, 2017:

• Entities expending more than $750,000 in federal funds are subject to a single audit. The financial statement portion (CAFR) was completed in December 2017 and reported to the committee in January 2018.
• The city was classified as a low-risk auditee for the first time in several years, requiring test coverage of only 20 percent of total federal awards (high-risk entities require 40 percent).
• Five major programs were audited, and 27.2 percent coverage was obtained, exceeding the 20 percent benchmark.
• A clean opinion was issued with no current-year findings on internal control over compliance, the compliance requirements themselves, or the schedule of expenditures of federal awards.
• Prior audit findings: the National Urban Search and Rescue Program finding (2015/16) was fully corrected; a second 2015 finding was fully corrected; the 2016-003 lead-based program finding was partially corrected, with some reports one to two days late.
• Starkey stated the trend has improved every year since 2011; this was the first year the city was not considered high-risk, attributed to no significant findings in 2015 and 2016 (a two-year look-back). He confirmed there were no concerns identified that did not rise to materiality.

Annual Report on Internal Financial Controls for 2017 (Discussion Item 2)

Scott Clark (Comptroller Assistant Director), Sally Ruby (Internal Controls Manager), and Sarah Mayon presented:

• The report satisfies a municipal code requirement (in place since 2006) for the chief financial officer to evaluate internal controls over financial reporting and submit a written report to the audit committee and city council.
• The internal control program is based on the COSO (Committee of Sponsoring Organizations of the Treadway Commission) framework covering five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.
• A newly established Administrative Regulation 95.39 defines management responsibilities for establishing, maintaining, monitoring, and complying with internal financial controls.
• Management identified five risks to financial reporting: changes in processes, organizational change, changes in accounting standards, changes in external conditions, and employee turnover.
• In FY2017, management identified potential reporting misstatements regarding reimbursement agreements and working capital advances; related controls were implemented, and no findings or significant deficiencies were identified through the CAFR audit.
• Approximately 895 identified processes require documentation, of which 488 have been formally documented. The increase from roughly 700 processes last year was attributed to breaking down CAFR disclosure notes (e.g., the pension note) into sub-processes.
• Of 115 administrative regulations posted online, 63 have been updated and 52 are in various stages of completion.
• The controller's office is monitoring new technology implementations (SAP modules, Excel) through representation on the technology committee and the Department of IT's change control board, with emphasis on segregation of duties and clear role definitions.
• Committee members commended the office's progress and the tone-at-the-top emphasis, noting the mayor's and chief operating officer's support. Lisa Byrne (IBA) complimented the office for showing the relevance and importance of internal controls in the context of the city's activities.

Public Comments on the City Auditor Appointment (Discussion Item 3)

• John Gordon (District 7, management consultant, former CFO, and member of the 2007-2008 Charter Review Committee): Recalled the city's period of municipal fraud and mismanagement, including the SEC bond disclosure charges and the "Enron by the Sea" moniker. He expressed the strong recommendation that the next city auditor must not be anyone who currently lives in San Diego or is known at City Hall, arguing that true independence is necessary, and urged the committee and council to set exacting and demanding standards for Mr. Luna's eventual replacement.
• John Stump (also submitted a letter and visual): Complimented the committee, Ms. Tevlin, and the auditor's department on progress to date, but stated there is a flaw in that the auditor is appointed by the executive branch (the mayor) whom he audits. He proposed removing that section of the charter so the appointment comes out of the audit committee, and recommended consulting with the Rules Committee and reviewing municipal code processes to improve the system, including potentially removing the mayor from the process.

City Auditor Appointment Consultation (Discussion Item 3, continued)

• The chair noted that City Charter Section 39.2 and San Diego Municipal Code 26.1701 require the audit committee to consult with the mayor on the appointment of the city auditor, who serves a 10-year term. Nine years have elapsed since Eduardo Luna's appointment.
• Andrea Tevlin (IBA) provided historical context: The 2006 governance change from city manager to strong-mayor form resulted from the pension scandal and the Kroll Report, with an SEC-appointed oversight monitor. In 2007, Eduardo Luna was hired as an internal auditor reporting to the mayor prior to charter changes; upon the 2009 charter amendments, he was appointed independent city auditor. The 2007 recruitment process was collaborative: the mayor managed the recruitment firm; the audit committee reviewed the RFQ and recruitment materials; a screening panel (audit committee chair, mayoral staff, and IBA) narrowed candidates; and both the mayor and the full audit committee interviewed candidates separately. Tevlin noted the charter language leaves the process open to interpretation.
• Felipe Monroe (Mayor's Office) corrected that Luna was hired in October 2007, not March, and stated the appointment process is expected to take roughly six months, targeting completion by the end of 2018, including identifying an outside recruitment firm to attract a large pool of qualified candidates.
• Councilmember Sherman nominated Tom Hebrink to serve as the public member of the appointment subcommittee, citing Hebrink's long experience on the committee, his knowledge of its workings, and the absence of any perceived conflict given his upcoming term end. Hebrink accepted, noting his prior experience with the SEC monitor and the Kroll Report process, and expressed confidence the committee could accomplish the process during his remaining tenure.

Key Outcomes

• Item 2 (Internal Financial Controls for 2017): Motion by Mr. Hebrink, seconded by Mr. Valdivia, to accept the report and forward it to the full City Council—approved unanimously.
• Item 3 (City Auditor Appointment): Motion by Councilmember Sherman, seconded by Mr. Valdivia, appointing Tom Hebrink as the public member to serve on the audit committee subcommittee (with the committee chair) to consult with the mayor's office and the IBA on the selection of the next city auditor—approved unanimously.
• The committee received reports on items 4, 5, and 1 as information; no formal action was taken on those items.
• The next Audit Committee meeting is scheduled for June 27, 2018.